IPSec: Internet Key Exchange

1. IPSec: Internet Key Exchange Slides by Vitaly Shmatikov UT Austin

2. Secure Key Establishment • Goal: generate and agree on a session key using some public initial information • What properties are needed? • Authentication (know identity of other party) • Secrecy (generated key not known to any others) • Forward secrecy (compromise of one session key does not compromise keys in other sessions) • Prevent replay of old key material • Prevent denial of service • Protect identities from eavesdroppers • Other properties you can think of???

3. Key Management in IPSec • Manual key management • Keys and parameters of crypto algorithms exchanged offline (e.g, by phone), security associations established by hand • Pre-shared symmetric keys • New session key derived for each session by hashing pre-shared key with session-specific nonces • Standard symmetric-key authentication and encryption • Online key establishment • Internet Key Exchange (IKE) protocol • Use Diffie-Hellman to derive shared symmetric key

4. Diffie-Hellman Key Exchange • Assume finite group G = S,  • Choose generator g so every xS is x = gn for some n • Example: integers modulo prime p • Protocol ga mod p gb mod p A B Alice, Bob share gab mod p not known to anyone else

5. Participants can’t tell gx mod p from a random number: send them garbage and they’ll do expensive exponentiations Vulnerable Diffie-Hellman Key Exchange ga mod p gb mod p A B Authentication? Secrecy? Replay attack? Forward secrecy? Denial of service? Identity protection? No Only against passive attacker Vulnerable Yes Yes

6. IKE Genealogy Diffie-Hellman Station-to-Station + authentication, identity protection 1976 Diffie, van Oorschot, Wiener 1992 + defense against denial of service ISAKMP Photuris NSA 1998 “generic” protocol for establishing security associations + defense against replay Karn, Simpson 1994-99 + compatibility with ISAKMP Oakley IKE Orman 1998 Cisco 1998 IKEv2 IETF draft September 23, 2004

7. Design Objectives for Key Exchange • Shared secret • Create and agree on a secret which is known only to protocol participants • Authentication • Participants need to verify each other’s identity • Identity protection • Eavesdropper should not be able to infer participants’ identities by observing protocol execution • Protection against denial of service • Malicious participant should not be able to exploit the protocol to cause the other party to waste resources

8. Ingredient 1: Diffie-Hellman A  B: ga B  A: gb • Shared secret is gab, compute key as k=hash(gab) • Diffie-Hellman guarantees perfect forward secrecy • Authentication • Identity protection • DoS protection

9. Ingredient 2: Challenge-Response A  B: m, A B  A: n, sigB(m, n, A) A  B: sigA(m, n, B) • Shared secret • Authentication • A receives his own number m signed by B’s private key and deduces that B is on the other end; similar for B • Identity protection • DoS protection

10. DH + Challenge-Response ISO 9798-3 protocol: A  B: ga, A B  A: gb, sigB(ga, gb, A) A  B: sigA(ga, gb, B) • Shared secret: gab • Authentication • Identity protection • DoS protection m := ga n := gb

11. Ingredient 3: Encryption Encrypt signatures to protect identities: A  B: ga, A B  A: gb, EncK(sigB(ga, gb, A)) A  B: EncK(sigA(ga, gb, B)) • Shared secret: gab • Authentication • Identity protection (for responder only!) • DoS protection k=hash(gab)

12. Refresher: DoS Prevention • Denial of service is often caused by malicious resource clogging • If responder opens a state for each connection attempt, attacker can initiate thousands of connections from bogus or forged IP addresses • Cookies ensure that the responder is stateless until initiator produced at least 2 messages • Responder’s state (IP addresses and ports) is stored in an unforgeable cookie and sent to initiator • After initiator responds, cookie is regenerated and compared with the cookie returned by the initiator • The cost is 2 extra messages in each execution

13. Refresher: Anti-DoS Cookie • Typical protocol: • Client sends request (message #1) to server • Server sets up connection, responds with message #2 • Client may complete session or not (potential DoS) • Cookie version: • Client sends request to server • Server sends hashed connection data back • Send message #2 later, after client confirms his address • Client confirms by returning hashed data • Need an extra step to send postponed message

14. Ingredient 4: Anti-DoS Cookie “Almost-IKE” protocol: A  B: ga, A B  A: gb, hashKb(gb, ga) A  B: ga, gb, hashKb(gb, ga) EncK(sigA(ga, gb, B)) B  A: gb, EncK(sigB(ga, gb, A)) • Shared secret: gab • Authentication • Identity protection • DoS protection? Doesn’t quite work: B must remember his DH exponential b for every connection k=hash(gab)

15. Medium-Term Secrets and Nonces • Idea: use the same Diffie-Hellman value gab for every session, update every 10 minutes or so • Helps against denial of service • To make sure keys are different for each session, derive them from gab and session-specific nonces • Nonces guarantee freshness of keys for each session • Re-computing ga, gb, gab is costly, generating nonces (fresh random numbers) is cheap • This is more efficient and helps with DoS, but no longer guarantees forward secrecy (why?)

16. CookieI CookieI, CookieR, offer crypto CookieI, CookieR, ga mod p, select crypto CookieI, CookieR, gb mod p switch to K=h(gab mod p) switch to K=h(gab mod p) CookieI, CookieR, EncK(“I”, sigI(previous msgs)) CookieI, CookieR, EncK(“R”, sigR(previous msgs)) (Simplified) Photuris [Karn and Simpson] Random number (identifies connection) Hash(source & dest IP addrs, CookieI, ports, R’s local secret) I R Alice is called “Initiator” for consistency with IKE terminology Bob is called “Responder”

17. IKE Genealogy Redux Diffie-Hellman Station-to-Station + authentication, identity protection 1976 Diffie, van Oorschot, Wiener 1992 + defense against denial of service ISAKMP Photuris NSA 1998 “generic” protocol for establishing security associations + defense against replay Karn, Simpson 1994-99 + compatibility with ISAKMP Oakley IKE Orman 1998 Cisco 1998 IKEv2 IETF standard December 2005

18. Cookies in Photuris and ISAKMP • Photuris cookies are derived from local secret, IP addresses and ports, counter, crypto schemes • Same (frequently updated) secret for all connections • ISAKMP requires unique cookie for each connect • Add timestamp to each cookie to prevent replay attacks • Now responder needs to keep state (“cookie crumb”) • Vulnerable to denial of service (why?) • Inherent conflict: to prevent replay, need to remember values that you’ve generated or seen before, but keeping state allows denial of service

19. IKE Overview • Goal: create security association between 2 hosts • Shared encryption and authentication keys, agreement on crypto algorithms • Two phases: 1st phase establishes security association (IKE-SA) for the 2nd phase • Always by authenticated Diffie-Hellman (expensive) • 2nd phase uses IKE-SA to create actual security association (child-SA) to be used by AH and ESP • Use keys derived in the 1st phase to avoid DH exchange • Can be executed cheaply in “quick” mode • To create a fresh key, hash old DH value and new nonces

20. Why Two-Phase Design? • Expensive 1st phase creates “main” SA • Cheap 2nd phase allows to create multiple child SAs (based on “main” SA) between same 2 hosts • Different conversations may need different protection • Some traffic only needs integrity protection or short-key crypto • Too expensive to always use strongest available protection • Avoid multiplexing several conversations over same SA • For example, if encryption is used without integrity protection (bad idea!), it may be possible to splice the conversations • Different SAs for different classes of service

21. IKEv1 Was a Mess • Two modes for 1st phase: “main” and “aggressive” • Fewer messages in “aggressive” mode, but no identity protection and no defense against denial of service • Main mode vulnerable to DoS due to bad cookie design • Many field sizes not verified; poor error handling • Four authentication options for each mode • Shared keys; signatures; public keys in 2 different ways • Special “group” mode for group key establishment • Grand total of 13 different variants • Difficult to implement, impossible to analyze • Security problems stem directly from complexity

22. Optional: refuse 1st message and demand return of stateless cookie ga mod p, crypto proposal, Ni CookieR CookieR, ga mod p, crypto proposal, Ni gb mod p, crypto accepted, Nr EncK(“I”, sigI(m1-4), [cert], child-SA) EncK(“R”, sigR(m1-4), [cert], child-SA) IKEv2: Phase One R I switch to K=f(Ni,Nr,crypto,gab mod p) Instead of running 2nd phase, “piggyback” establishment of child-SA on initial exchange Initiator reveals identity first Prevents “polling” attacks where attacker initiates IKE connections to find out who lives at an IP addr

23. EncK(proposal, Ni, [ga mod p], traffic) EncK(proposal, Nr, [gb mod p], traffic) IKEv2: Phase Two (Create Child-SA) After Phase One, I and R share key K R I Crypto suites, protocol (AH, ESP or IPcomp) Optional re-key using old DH value and fresh nonces IP address range, ports, protocol id Can run this several times to create multiple SAs

24. Other Aspects of IKE We did not talk about… • Interaction with other network protocols • How to run IPSec through NAT (Network Address Translation) gateways? • Error handling • Very important! Bleichenbacher attacked SSL by cryptanalyzing error messages from an SSL server • Protocol management • Dead peer detection, rekeying, etc. • Legacy authentication • What if one of the parties doesn’t have a public key?

25. Current State of IPSec • Best currently existing VPN standard • For example, used in Cisco PIX firewall, many remote access gateways • IPSec has been out for a few years, but wide deployment has been hindered by complexity • ANX (Automotive Networking eXchange) uses IPSec to implement a private network for the Big 3 auto manufacturers and their suppliers